Ride services company Uber Technologies Inc [UBER.UL] for years has used a secret tool to avoid authorities in markets where its service faced resistance by law enforcement or was banned, the company confirmed on Friday.

The New York Times first reported the existence of the programme, called Greyball, which uses data from the Uber app and other methods to identify and circumvent officials who aimed to ticket or apprehend drivers in cities that opposed its operations.

Rides hailed from a location near a city enforcement agency suspected of launching a sting to trap Uber drivers could be ignored or cancelled, for instance, the Times report said.

The tool allowed Uber to show images of "ghost" Uber cars on the app or show that no cars were available, according to the newspaper, in order to deceive authorities. Officials in certain cities without a legal framework for ride services have aimed to ticket, tow and impound the cars.

A spokeswoman for Uber said Greyball was still in use, though scaled back. It grew out of an effort to protect the app from disruption by competitors and drivers from abuse and, in more rare cases, was also used where there were enforcement stings, she said.

Meanwhile, Uber's best-known security researcher and vice president of product and growth resigned on Friday, without giving reasons. It was unclear if the departures were connected to Greyball.

Revelations about the Greyball programme come after a series of events bringing Uber's practices into doubt that has raised customer and investor concern.

Those include allegations of sexual harassment that prompted an internal investigation at the company, a video of Chief Executive Travis Kalanick arguing with an Uber driver that led him to make a public apology and pledge to "grow up", and a lawsuit by Alphabet Inc's self-driving car unit, Waymo, accusing Uber of stealing designs for technology for autonomous cars. Uber has said Waymo's claims are false.

In an email, Uber said the Greyball programme "denies ride requests to fraudulent users who are violating our terms of service — whether that's people aiming to physically harm drivers, competitors looking to disrupt our operations, or opponents who collude with officials on secret 'stings' meant to entrap drivers."

The tactic had been scaled back considerably as the company won the right to operate in more places, a spokeswoman added.

She said that Uber’s legal department had approved the practice in locations where Uber was not clearly banned, and that Uber's terms of use required riders use the ride hailing app for personal, not commercial, reasons and to not cause "nuisance" to drivers.

The programme is still being used when drivers are under threat of arrest or other legal punishment in some cities within 15 US states without clear ride-sharing laws, she said, adding that she did not know in which other countries the system is being used.

A source earlier on Friday had told Reuters that the programme had not been in use in the United States for more than a year.

The New York Times said Uber used the methods to evade authorities in cities including Boston, Paris and Las Vegas, and in countries such as Australia, China, Italy and South Korea.

Once the Greyball tool was put in place and tested, Uber engineers created a playbook with a list of tactics, which included looking up city officials on social media and obtaining phone numbers of cheap phones that Uber calculated enforcement officials were likely to buy, the Times said. Local officials on Friday expressed concern about Uber’s practices but stopped short of saying they would take action.

“We take any effort to undermine our efforts to protect the public very seriously,” Dylan Rivera, a spokesman for the Portland, Oregon transportation bureau, said in a statement. “We will closely examine the evidence presented in this investigation to see if it warrants changes in our approach to consumer protection.”

Boston police Lieutenant Mike McCarthy said his department would also review the allegations and Philadelphia Parking Authority spokesman Martin O’Rourke said his agency was aware of Uber’s attempts to evade local inspectors and the activity was covered by a settlement agreement that the authority and the company signed last year, in which Uber paid a $350,000 fine.

Greyball, which began as early as 2014, was part of a programme called "Violation of terms of service" (VTOS), aimed at finding people the ride-hailing company thought were using the app improperly, the New York Times reported.

Two high-level departures on Friday added to Uber's woes. Ed Baker, Uber’s vice president of product and growth, is leaving the company after nearly four years, an Uber spokeswoman said, declining to provide a reason.

Also announcing his departure Friday was the best-known security researcher at Uber. Charlie Miller, who won fame beyond the security industry for hacking into a Jeep as it was driving, said on Twitter that he was leaving after a year and a half of working on security for autonomous driving. He said he would announce where he was headed next week.